/*     */ package com.zimbra.cs.account.accesscontrol;
/*     */ 
/*     */ import com.zimbra.common.account.Key.DistributionListBy;
/*     */ import com.zimbra.common.service.ServiceException;
/*     */ import com.zimbra.common.util.Log;
/*     */ import com.zimbra.common.util.SetUtil;
/*     */ import com.zimbra.common.util.ZimbraLog;
/*     */ import com.zimbra.cs.account.Account;
/*     */ import com.zimbra.cs.account.DistributionList;
/*     */ import com.zimbra.cs.account.Domain;
/*     */ import com.zimbra.cs.account.Entry;
/*     */ import com.zimbra.cs.account.GlobalGrant;
/*     */ import com.zimbra.cs.account.Provisioning;
/*     */ import com.zimbra.cs.account.Provisioning.GroupMembership;
/*     */ import java.util.HashSet;
/*     */ import java.util.Set;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public class ParticallyDenied
/*     */ {
/*  39 */   private static final Log sLog = ZimbraLog.acl;
/*     */   
/*     */   private static boolean isSubTarget(Provisioning prov, Entry targetSup, Entry targetSub) throws ServiceException
/*     */   {
/*  43 */     if ((targetSup instanceof Domain)) {
/*  44 */       Domain domain = (Domain)targetSup;
/*  45 */       Domain targetSubInDomain = TargetType.getTargetDomain(prov, targetSub);
/*  46 */       if (targetSubInDomain == null) {
/*  47 */         return false;
/*     */       }
/*  49 */       if (domain.getId().equals(targetSubInDomain.getId())) {
/*  50 */         return true;
/*     */       }
/*     */       
/*  53 */       Provisioning.GroupMembership groups = null;
/*  54 */       if ((targetSub instanceof Account)) {
/*  55 */         groups = prov.getGroupMembership((Account)targetSub, false);
/*  56 */       } else if ((targetSub instanceof DistributionList)) {
/*  57 */         groups = prov.getGroupMembership((DistributionList)targetSub, false);
/*     */       } else {
/*  59 */         return false;
/*     */       }
/*  61 */       for (String groupId : groups.groupIds()) {
/*  62 */         DistributionList group = prov.getDLBasic(Key.DistributionListBy.id, groupId);
/*  63 */         Domain groupInDomain = prov.getDomain(group);
/*  64 */         if ((groupInDomain != null) && (domain.getId().equals(groupInDomain.getId())))
/*     */         {
/*  66 */           return true;
/*     */         }
/*     */       }
/*     */       
/*  70 */       return false;
/*     */     }
/*  72 */     if ((targetSup instanceof DistributionList)) {
/*  73 */       DistributionList dl = (DistributionList)targetSup;
/*     */       
/*  75 */       String subId = null;
/*  76 */       if ((targetSub instanceof Account))
/*  77 */         return prov.inDistributionList((Account)targetSub, dl.getId());
/*  78 */       if ((targetSub instanceof DistributionList)) {
/*  79 */         return prov.inDistributionList((DistributionList)targetSub, dl.getId());
/*     */       }
/*  81 */       return false;
/*     */     }
/*  83 */     if ((targetSup instanceof GlobalGrant)) {
/*  84 */       return true;
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*  91 */     throw ServiceException.FAILURE("internal error, unexpected entry type: " + targetSup.getLabel(), null);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private static void checkDenied(Provisioning prov, Entry targetToGrant, Right rightToGrant, Set<SearchGrants.GrantsOnTarget> grantsOnTargets, String granteeId, Set<String> granteeGroups)
/*     */     throws ServiceException
/*     */   {
/* 114 */     for (SearchGrants.GrantsOnTarget grantsOnTarget : grantsOnTargets) {
/* 115 */       grantedOnEntry = grantsOnTarget.getTargetEntry();
/*     */       
/* 117 */       if (isSubTarget(prov, targetToGrant, grantedOnEntry)) {
/* 118 */         ZimbraACL grants = grantsOnTarget.getAcl();
/*     */         
/*     */ 
/* 121 */         for (ZimbraACE ace : grants.getDeniedACEs()) {
/* 122 */           if (((granteeId != null) && (granteeId.equals(ace.getGrantee()))) || ((granteeGroups != null) && (granteeGroups.contains(ace.getGrantee()))))
/*     */           {
/*     */ 
/* 125 */             if (rightToGrant.overlaps(ace.getRight())) {
/* 126 */               throw ServiceException.PERM_DENIED(String.format("insufficient right to grant. Right '%s' is denied to grp/usr '%s' on target %s", new Object[] { ace.getRight().getName(), ace.getGrantee(), grantedOnEntry.getLabel() }));
/*     */             }
/*     */           }
/*     */         }
/*     */       }
/*     */     }
/*     */     Entry grantedOnEntry;
/*     */   }
/*     */   
/*     */   private static void getAllGrantableTargetTypes(Right right, Set<TargetType> result) throws ServiceException
/*     */   {
/* 137 */     if ((right.isPresetRight()) || (right.isAttrRight())) {
/* 138 */       result.addAll(right.getGrantableTargetTypes());
/* 139 */     } else if (right.isComboRight())
/*     */     {
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 153 */       ComboRight cr = (ComboRight)right;
/* 154 */       for (Right r : cr.getAllRights()) {
/* 155 */         getAllGrantableTargetTypes(r, result);
/*     */       }
/*     */     }
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   static void checkPartiallyDenied(Account grantor, TargetType targetTypeToGrant, Entry targetToGrant, Right rightToGrant)
/*     */     throws ServiceException
/*     */   {
/* 172 */     if (AccessControlUtil.isGlobalAdmin(grantor, true)) {
/* 173 */       return;
/*     */     }
/* 175 */     Provisioning prov = Provisioning.getInstance();
/*     */     
/*     */ 
/* 178 */     Set<TargetType> subTargetTypes = targetTypeToGrant.subTargetTypes();
/*     */     
/*     */ 
/* 181 */     Set<TargetType> subRightsGrantableOnTargetTypes = new HashSet();
/* 182 */     getAllGrantableTargetTypes(rightToGrant, subRightsGrantableOnTargetTypes);
/*     */     
/*     */ 
/* 185 */     Set<TargetType> targetTypesToSearch = SetUtil.intersect(subTargetTypes, subRightsGrantableOnTargetTypes);
/*     */     
/*     */ 
/*     */ 
/* 189 */     if (targetTypesToSearch.isEmpty()) {
/* 190 */       return;
/*     */     }
/*     */     
/* 193 */     RightBearer.Grantee grantee = RightBearer.Grantee.getGrantee(grantor);
/* 194 */     Set<String> granteeIdsToSearch = grantee.getIdAndGroupIds();
/*     */     
/* 196 */     SearchGrants searchGrants = new SearchGrants(prov, targetTypesToSearch, granteeIdsToSearch);
/* 197 */     Set<SearchGrants.GrantsOnTarget> grantsOnTargets = searchGrants.doSearch().getResults();
/*     */     
/*     */ 
/* 200 */     checkDenied(prov, targetToGrant, rightToGrant, grantsOnTargets, grantor.getId(), null);
/*     */     
/*     */ 
/* 203 */     checkDenied(prov, targetToGrant, rightToGrant, grantsOnTargets, null, granteeIdsToSearch);
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/cs/account/accesscontrol/ParticallyDenied.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */